Control Web Panel OS Command Injection Vulnerability in Admin Index PHP

A command injection vulnerability has been identified in Control Web Panel (CWP) versions through 0.9.8.1208. The issue arises in the admin index.php file when the 'api' parameter is set. User input via the 'key' GET parameter is not properly sanitized, allowing unauthenticated attackers to inject and execute arbitrary operating system commands with root privileges on the web server. Successful exploitation requires Softaculous or SitePad to be installed through the Scripts Manager.

Impact

Exploitation of this vulnerability allows for arbitrary OS command execution with root privileges on the web server.

Reproduction

To reproduce this vulnerability, send a GET request to '/admin/index.php' with the 'api' parameter set to '1' and the 'key' parameter containing the command to be executed, prefixed with a command injection payload. The injected command will be executed on the server with root privileges.

Remediation

Users are advised to upgrade to Control Web Panel version 0.9.8.1209 or later.